Skip to main content
The Secfix Public API is a machine-to-machine (M2M) REST API for the Secfix compliance platform. Use it to read your asset inventory and monitored computers, and to update asset governance metadata — so your compliance data stays in sync with the rest of your stack.

Quickstart

Get an access token and make your first call in a few minutes.

Authentication

OAuth 2.0 client-credentials — how to obtain and use a bearer token.

API reference

Every endpoint, request, and response, generated from the OpenAPI contract.

Changelog

What’s new, changed, and deprecated in the API.

​
What you can do in v1

Inventory

List, read, and govern assets across every category — cloud, computers, custom, information, and employees.

Computers

Read monitored computers with aggregate device compliance posture.
Writes are limited to governance metadata (owner, description, classification, tags). The API never creates or deletes assets, and computers and employees are read-only.

​
Base URL

All API requests go to https://api.secfix.com.

​
How it works

1

Create an API key

In Settings → API in the Secfix web app, create an API key. You get a client_id and client_secret and choose its access level. See Managing API keys.
2

Get an access token

Exchange the client credentials for a short-lived bearer token at POST /oauth/token. See Authentication.
3

Call the API

Send the token as a bearer token on /v1 endpoints. Lists are cursor-paginated; errors follow RFC 7807. See the API reference.

​
Conventions at a glance